I did receive payouts at first, how can I see afterwards whether they came from the deposits of others?

Why does a platform pay out at first?

A platform pays out at first because a successful payout builds trust and thereby leads to a larger and longer deposit. In that case the payout is not a yield from an investment, but part of the recruitment.

The Dutch AFM describes this mechanism in pyramid and Ponzi fraud: returns are paid from the deposits of new investors, and when too few new participants join, the construction collapses (AFM on pyramid fraud, in Dutch). In its analysis of online fraud, Europol notes that networks behind investment fraud use pyramid-like tactics, such as encouraging participants to recruit others (Europol, Online fraud schemes).

For you as a participant the payout felt like proof that the platform worked. In hindsight the same payout is one of the most useful pieces of data in your file, because it has a sender. How an investigation into these situations generally works can be read on the page about crypto fraud investigation.

How can you see on the chain whether a payout came from the deposits of others?

You can see where a payout came from by opening the sender address of that payout and checking which payments that address received in the hours or days before. The pattern from the chain is more reliable than the explanation you received from the platform at the time, because it is fixed and cannot be changed afterwards.

With a platform that actually trades, the funds for a payout come from flows to and from trading platforms or other sources of yield. With a construction that pays out from the deposits of others, the picture looks different. Five signals keep recurring:

1. The address that paid you received deposits from many different addresses shortly before.
2. The timing of your payout follows new deposits, not sales or yields.
3. There are no flows between that address and a trading platform that could explain a return.
4. The payouts to you and to others are round amounts or fixed percentages of the deposit.
5. The payouts stop at the moment the inflow of new deposits decreases.

You can take a first look yourself. Look up the transaction hash of a payout in a public block explorer for the network concerned and open the sender address there. You then see the list of incoming and outgoing transactions of that address, with time and amount. If there are many deposits from unknown addresses just before your payout, followed by a series of outgoing amounts of similar size, you have the pattern in view. What you do not see is how those addresses relate to each other over a longer period; that requires following each line step by step.

None of these signals is decisive on its own. Together, and recorded per payout, they show whether your return came from a yield or from the deposits of others. The concept of investment fraud covers several constructions; this pattern is one of them.

Why are your incoming transactions so important?

Your incoming transactions are important because every payout you received is the only direct trail to the addresses the platform itself worked with. Yet this is the underestimated step: anyone building a file almost always notes what they transferred and forgets what came in.

An outgoing payment shows where your deposit went. An incoming payout shows where the platform’s money came from. The two directions complement each other: together they show which addresses the platform used to receive and which to pay. Paucitas regularly sees that it is precisely the paying address, the address that passed on the deposits of others, and not the receiving address, that shows the most connection with other participants.

So record for each incoming transaction: the date, the amount, the sender address, the transaction hash and the platform’s message announcing the payout. If you received via an exchange, export the receipt history of that account. More about investigation of this form of investing can be found on the question page investigation of crypto investment scams.

Case. An investor received a series of payouts in the first months after his deposit, which he saw as returns. When he wanted to withdraw a larger amount, the withdrawal got stuck and a request for extra costs followed.

In the investigation his payouts were traced back one by one. They all came from the same address. In the hours before each payout, that address received deposits from dozens of other addresses and forwarded amounts to participants almost immediately afterwards, including him. There were no flows from or to a trading platform in that period. When the deposits decreased, the payouts stopped as well. The report showed per payout which inflow preceded it.

The limit. Paucitas does not independently establish who is behind a crypto address. What is recorded is to which service provider or party funds have gone, so that this information can be followed up through the appropriate channels.

Are your payouts proof of fraud?

Your payouts are not a verdict on fraud, but they are a recorded fact showing from which source the platform paid you, and whether that source was the deposits of others. Whether there is fraud is a question for the competent authority; what an investigation provides is the factual structure on which that question can be answered.

That structure can be described in three components: the addresses where participants deposited, the addresses from which payouts came, and the connection in time and amount between the two. With that overview in hand you no longer need to describe what the platform told you, but can show what actually happened. The order is fixed: first the investigation, after which you can use the report to file a police report.

Your payouts also count in your own overview. The amount you received back at the time belongs next to your total deposit, so that it is established what you deposited on balance and what is still outstanding. A file that only mentions the deposits gives a different picture from what is on the chain, and that difference stands out in every later assessment.

What a private individual can expect from us in such a process is described on the page for private individuals.

How does Paucitas record the payout pattern?

Paucitas traces every payout you received back to the sender address, maps the inflow on that address and records per payout which deposits preceded it. Your own deposit is followed forward in the same way, so that both directions come together in one report.

Paucitas uses no automated analysis software, in any role. The investigation is carried out by hand on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

If you want to know where your earlier payouts came from, Paucitas starts with your incoming and outgoing transactions; see blockchain research. How a crypto investment scam fits together from beginning to end can be read in the related blog how exactly does a crypto investment scam work. For your own file, contact Paucitas.